PT-2018-14942 · Portainer · Portainer

Gustavo Lichti · Published 2018-11-20 · Updated 2019-10-03 · CVE-2018-19367

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Portainer versions prior to 1.19.3

Description The issue allows attackers to set an admin password under certain conditions. Specifically, it involves the API endpoint "/api/users/admin/check" which checks if the admin user is already created. If the admin user was not created, this endpoint returns a 404 status code, and if the admin user was already created, it returns a 204 status code. Attackers can exploit the 404 case to set an admin password.

Recommendations For Portainer versions prior to 1.19.3, as a temporary workaround, consider restricting access to the "/api/users/admin/check" API endpoint until a patch is available. Avoid using this endpoint to verify admin user creation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2018-19367

Affected Products

Portainer

References · 4

• 🔥 https://github.com/portainer/portainer/issues/2475 · Exploit
• 🔥 https://github.com/lichti/shodan-portainer · Exploit
• https://osv.dev/vulnerability/CVE-2018-19367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19367 · Security Note